Poisoning attack against machine learning algorithms has become an emerging research in the field of adversarial machine
learning [1]}, [2]}, [3]}. Over the years, different types of poisoning attacks have been proposed in the literature, including label flipping attack [4]}, [5]}, [6]}, [7]}. These attacks work by switching training labels while leaving the data instances untouched. They have the advantage of not introducing strange-looking artifacts, which may be obvious to the intended victim. One prominent work in this area is the attack proposed by Biggio et al.[4]} to evaluate the effectiveness of Support Vector Machines (SVM) in adversarial classification tasks. The authors adopt two different strategies for contaminating the training set through label flipping: random and adversarial label flips. In both cases, they assumed that an adversary can only flip the labels of a given percentage of training samples. Zhang et al.[9]} established a game-theoretic framework for attacking SVM models. Zhao et al.[10]} developed Projected Gradient Ascent
(PGA) algorithm to compute a label contamination attack (LCA) which improved the SVM-based works. paudice et al.[6]} proposed an efficient algorithm to perform
optimal label flipping poisoning attacks.
From the perspective of defending against label flipping poisoning attacks on modern ML, Paudice et al.[6]} proposed k-Nearest-Neighbors (kNN) to re-label reach data point to mitigate label flipping attacks. Specifically, they re-label each data point with the most common label among its \(K\)  nearest neighbors.
